SCIM Token generation using SDDC API fails with error 'PKIX path validation failed' in VMware Cloud Foundation

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• Generate the Secret using SDDC Manager API is followed to generate SCIM Token on the SDDC Manager using API to extend the token validity to 12 months.
  
  
• The following error appears in the API response :
  
  'Failed to create/update Microsoft entra id identity provider. Registration of SDDC Manager as Relying Party failed due to PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed'


• Verification of the SDDC Manager truststore reveals one or more certificates are expired.
  
  
• The following command is used to verify the certificates:
  
  keytool -list -v -keystore /etc/vmware/vcf/commonsvcs/trusted_certificates.store -storepass $(cat /etc/vmware/vcf/commonsvcs/trusted_certificates.key) | grep -E "Alias name|Valid from"

Environment

VMware Cloud Foundation 5.x

Cause

• The error occurs because Java's strict certificate path validation evaluates the entire SDDC Manager truststore during outbound TLS handshakes, failing the connection if any certificate is expired.
• Consequently, legacy or unused certificates left in the truststore will inadvertently block valid API communication with Microsoft Entra ID.

Resolution

1. SSH to the SDDC Manager VM as the VCF user and then issue the su - command to switch to the root user.
   
   
2. Obtain the trusted certificates key by issuing the following command:
   cat /etc/vmware/vcf/commonsvcs/trusted_certificates.key


3. List all the trusted root certificates with the validity:
   keytool -list -v -keystore /etc/vmware/vcf/commonsvcs/trusted_certificates.store -storepass $(cat /etc/vmware/vcf/commonsvcs/trusted_certificates.key) | grep -E "Alias name|Valid from"


4. Delete the expired certificates by replacing the <alias> with the alias name obtained from the above command:
   keytool -delete -alias <alias> -keystore /etc/vmware/vcf/commonsvcs/trusted_certificates.store
   
   
5. Restart all the services:
   /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh
   
   
6. Follow the KB and regenerate the token which will be active for 12 months: Configuration of Entra ID on SDDC Manager reports the lifespan of the secret token to 6 months even though the Token Lifespan is set as 12 or 18 months